Judge Tosses Long-Running Section 215 Surveillance Lawsuit

from the it's-time-for-the-Supreme-Court-to-stop-dodging-difficult-surveillance-quest dept

A federal judge has issued the final word in one long-running dragnet surveillance suit. The lawsuit, filed by Larry Klayman immediately after the first Snowden leak, alleged the Section 215 phone records program -- targeting Verizon Business customers according to the leaked document -- was unconstitutional. DC district court judge Richard Leon agreed, issuing an injunction in December 2013 demanding a cessation of the Section 215 dragnet.

This order was immediately stayed to allow the government to appeal (and to continue harvesting domestic phone records in bulk). The Appeals Court disagreed with Leon, sending the case back for another ruling. It didn't change anything at the lower level. Judge Leon still found the program unconstitutional and ordered the NSA to stop collecting the phone records of the two named plaintiffs.

Shortly after this ruling, the USA Freedom Act ended the NSA's bulk collection of phone records, largely rendering the lawsuit moot. After another round of appeals, the government asked Judge Leon to dismiss the case entirely. Judge Leon has done so, agreeing with the government that the implementation of the USA Freedom Act prevents it from collecting phone records in bulk and brings it in line with the injunction previously issued by Leon. The plaintiffs were hoping a round of discovery would produce records substantiating their claims of warrantless surveillance of the single named client. Judge Leon has denied additional requests by the plaintiffs and dismissed [PDF] the case with prejudice.

[E]ven if plaintiffs were able to establish -- through jurisdictional discovery -- that the NSA had, in fact, collected their telephony metadata, they still would not be able to overcome the jurisdictional defect in this case. Because bulk collection under Section 215 is now prohibited by statute, plaintiffs' claims for injunctive relief against bulk collection are moot, regardless of whether the Government actually collected and queried plaintiffs' telephony metadata pursuant to the Section 215 program in the past.

The decision closes with Judge Leon expressing his hope the Supreme Court might step in and address the Third Party Doctrine directly and more closely examine the "expectation of privacy" concept in the context of today's communication methods. (This is why the upcoming Carpenter case -- dealing with warrantless collection of historical cell site information -- bears watching.)

While the zeal and vigilance with which plaintiffs have sought to protect our Constitutional rights is indeed laudable, this Court, in the final analysis, has no choice but to dismiss these cases for plaintiffs' failure to demonstrate the necessary jurisdiction to proceed. I do so today, however, well aware that I will not be the last District Judge who will be required to determine the appropriate balance between our national security and privacy interests during this never-ending war on terror. Hopefully by the time these issues are next joined, our Supreme Court will have had the opportunity to provide us with further guidance on the parameters of our privacy interests in this era of ever-increasing electronic communication. If not, concerned citizens such as these will continue to shoulder the heavy yoke that vigilance to our Constitutional liberties surely requires.

Filed Under: 4th amendment, larry klayman, mass surveillance, nsa, richard leon, section 215, surveillance

NSA Section 702 Q&A Glosses Over Incidental Collection Problems, Domestic Surveillance

from the mostly-true-and-mostly-misleading dept

As the clock winds down to the end of the year, the NSA (along with the FBI, CIA, and other government components with access to NSA collections) is hoping it won't have its internet surveillance programs limited in any way. So far, it's receiving plenty of help from the Senate Intelligence Committee, which has offered up a zero-reform package. (The House has its own version, which actually includes a few reforms, but it still leaves plenty of loopholes for domestic surveillance.)

To that end, the NSA has released a highly-misleading Q&A on Section 702 surveillance -- one that conveniently ignores its historic problems with incidental collection and the other authorities being renewed that actually do allow it to target US persons.

The NSA chooses to focus solely on Section 702 and the issue of targeting. But these focal points are misleading. The NSA has plenty of ways of obtaining US persons' communications without targeting them. On top of that, the NSA has a few options for targeting US persons that go completely unmentioned. And the FBI is allowed to target US persons for a number of reasons using NSA surveillance programs -- again, something the Q&A ignores completely.

Section 702 surveillance is done under Title VII, which also includes US person-targeting authorities like Section 704 and 705(b). Not much discussion has centered on these two authorities because they aren't used that often. But they do absolutely allow the NSA to target US persons, unlike Section 702.

But there are problems with Section 702's foreign-facing work as well. In addition to targeting adversaries, Section 702 also allows the NSA to target friendly foreigners, like high-ranking government officials. Even while remaining foreign-focused, the program has still swept up US persons' communications. Some of this "incidental" collection was eliminated when the NSA dropped its "about" email collection. But even with its voluntary move, the NSA is still sweeping up US communications inadvertently.

This is a boon for the FBI, which is allowed to perform backdoor searches on Americans for evidence of criminal activity. This isn't limited to terrorist activity or foreign crimes. The bill offered up by the Senate would actually expand the FBI's use of NSA collections by adding a number of new crimes to the list of search justifications.

The assurances offered by the NSA are false. Marcy Wheeler's impeccable takedown of the self-serving Q&A points out the disingenuousness of the NSA fielding its own softball questions.

Curiously, while the NSA doesn't address the disproportionate impact of 702 on Muslims, it does pretend to address the disproportionate impact on Asians or their family members — people like like Xiaoxiang Xi and Keith Gartenlaub.

Q: Could the government target my colleague, who is a citizen of an Asian country, as a pretext to collect my communications under Section 702?

A: No. That would be considered "reverse targeting" and is prohibited.

Thanks to Ron Wyden, we know how cynically misleading this answer is. He explained in the SSCI 702 reauthorization bill report that the government may,

conduct unlimited warrantless searches on Americans, disseminate the results of those searches, and use that information against those Americans, so long as it has any justification at all for targeting the foreigner.

Effectively, the government has morphed the "significant purpose" logic from the PATRIOT Act onto 702, meaning collecting foreign intelligence doesn't have to be the sole purpose of targeting a foreigner; learning about what an American is doing, such as a scientist engaging in scientific discussion, can be one purpose of the targeting.

The NSA tops off its Q&A by (accurately) claiming it can't search 702 collections for US person information. But it does not point out other government agencies can -- and can do it with very little oversight. That's what the FBI does routinely but not once in the Q&A will you find any reference to outside agency data store access.

The NSA's pro-702 pitch may be factual, but only because it carefully excises all of the inconvenient facts -- ones that might cause more people to question the collection and data search procedures being renewed.

Filed Under: domestic surveillance, mass surveillance, nsa, section 702

With Congressional Leaders Blocking Serious Reform, Tepid Section 702 Reform Bill Moves Forward

from the death-by-a-thousand-indifferences dept

"Better than nothing" appears to be the motto of the House of Representatives' attempt to implement Section 702 reforms before the end of the year. The USA Liberty Act was introduced in October, bringing with it a few minor alterations to the NSA's collection efforts. Perhaps the best thing about the bill was its codification of the NSA's retirement of its "about" email collection. This would prevent the NSA from restarting a collection responsible for the greatest "incidental" harvesting of domestic communications (that we know of).

It also would expand reporting requirements for agencies making use of Section 702 collections as well as extend whistleblower protections to government contractors. Unfortunately, the bill does not close the loophole allowing "backdoor" searches of domestic communications collected by the program.

Beyond that, Section 702 stays pretty much intact. It's better than leaving it unaltered, but it's far less comprehensive (in terms of reforms) than the option introduced in the Senate by Ron Wyden. Unfortunately, the Senate is far more likely to pass the zero reform effort offered by the NSA's oversight -- one that allows the NSA to restart its "about" collection, as well as expand the number of criminal activities that will justify backdoor searches of NSA data stores. That's the bill that's already advanced, according to David Ruiz of the EFF, who brings more bad tidings along with this news.

The House Judiciary Committee on Wednesday approved the USA Liberty Act, a surveillance reform package introduced last month by House Judiciary Committee Chairman Bob Goodlatte (R-VA) and Ranking Member John Conyers (D-MI). The bill is seen by many as the best option for reauthorizing and reforming Section 702 of the FISA Amendments Act of 2008, which is set to expire in less than two months.

Some committee members described feeling forced to choose between supporting stronger surveillance reforms or advancing the Liberty Act, and voiced their frustration about provisions that only partly block the warrantless search of Americans’ communications when an amendment with broader surveillance reforms was introduced by Reps. Zoe Lofgren (D-CA) and Ted Poe (R-TX). Complicating their deliberations was the fact that the Senate Select Committee on Intelligence has already reported out a bill with far fewer surveillance protections.

The more stringent amendment has been stiff-armed by Congressional leadership, who have made it clear they'll kill the entire reform bill if this amendment remains attached. Still, the Lofgren/Poe amendment has its supporters, but this support is largely composed of representatives on the wrong side of political equation. In a Republican-led house, the support of scattered Democrats is pretty much useless.

House leadership apparently does not want Section 702 to undergo any serious reforms. So, it's let representatives know they can have a watered-down reform bill or nothing at all.

Rep. Sheila Jackson Lee (D-TX)... appeared frustrated with the situation: “I’ll put on record that I resent being held hostage by leadership that does not know the intensity of the work and the responsibilities of the judiciary committee.”

This is how things work in the beltway. Top reps with the power to kill bills are willing to nod briefly at reform, but unwilling to undertake the sort of effort required to rein in the NSA and several domestic agencies with access to 702 collections. The administration has made it clear it's not interested in changing a thing in terms of surveillance, giving Congressional leaders all the reason they need to continue toeing the line.

Filed Under: congress, nsa, section 702, surveillance, surveillance reforms

Wyden's Reform Bill Would Also Deter Misuse Of NSA Powers To Compel Tech Company Assistance

from the not-just-backdoors dept

Sen. Ron Wyden is again raising concerns about NSA tactics, this time through his recently-submitted Section 702 reform bill. The USA RIGHTS Act contains a number of improvements, including addressing backdoor searches of NSA data by federal agencies and increasing the reporting requirements for access of US persons communications and data. It also permabans the NSA's "about" collection -- one it shut down voluntarily after years of misuse but recently expressed an interest in restarting.

There's another form of surveillance being eyed by Wyden's bill: technical assistance. Marcy Wheeler points out some of the limitations imposed by the bill, which appear to target compelled assistance by tech companies.

(B) LIMITATIONS.—The Attorney General or the Director of National Intelligence may not request assistance from an electronic communication service provider under subparagraph (A) without demonstrating, to the satisfaction of the Court, that the assistance sought—

(i) is necessary;

(ii) is narrowly tailored to the surveillance at issue; and

(iii) would not pose an undue burden on the electronic communication service provider or its customers who are not an intended target of the surveillance.

This could refer to FISA-enabled pressure to backdoor encryption or allow the NSA to otherwise compromise hardware and software. And it may be Wyden's way of sending out a heads up to the general public.

This suggests that Wyden is concerned the government might use — or has used — FISA to make sweeping onerous technical demands of companies without explicitly explaining what those demands are to the Court.

No one should be surprised the government is -- or intends to -- use the FISA court to compel compliance. This is another tool it has at its disposal, going hand-in-hand with All Writs orders to cover government requests not explicitly allowed by existing law. As we saw in the government's most famous All Writs case -- its legal battle with Apple over the contents of the San Bernardino shooter's iPhone -- these expansive orders predicated on a 1789 law still have their limits. As more companies fight back against government overreach, the NSA will need to keep its options open if it hopes to compel compliance.

But if it's going to do this, it needs to be on the record. This is what Wyden's bill would do: force the NSA (and other IC agencies) to detail their plans for compelled assistance and seek explicit approval for these actions from the court.

Filed Under: all writs act, compelled assistance, nsa, ron wyden, surveillance, usa rights act

Declassified Docs Show NSA Trying To Prosecute A Journalist For His Successful FOIA Requests

from the war-on-whistleblowers,-leakers,-and-FOIA-records-requesters dept

MuckRock has been digging into a large pile of declassified CIA documents for the past several months and has come up with some surprising finds. It recently liberated nearly 13 million pages of CIA documents -- known as the CREST archive -- via a FOIA lawsuit. Since this monumental release, MuckRock has covered everything from a CIA report on an Italian pasta shortage to deeper, darker topics like a CIA asset in Mexico being linked to a long list of atrocities.

Digging through the CIA's archives has dug up dirt on other agencies as well. Emma Best details another MuckRock/CIA gem -- one that shows the NSA attempting to prosecute a journalist for obtaining documents via FOIA requests.

Declassified documents in the Central Intelligence Agency’s archives show that while the CIA was looking to include the Freedom Of Information Act in its war on leaks, the National Security Agency was seriously considering using the Espionage Act to target target Puzzle Palace author James Bamford for using FOIA.

While Bamford has briefly discussed this on a handful of occasions, the declassified memos and briefings from NSA confirm that this was more than just an intimidation tactic or a passing thought - the NSA had truly wanted to jail a journalist for his use of public records. When the Agency determined that this was unlikely to happen, they moved on to exploring other legal avenues which could be used to punish Bamford for his FOIA work.

The chain of events leading up to the NSA's discussion about prosecuting someone for doing something the law specifically allowed unsurprisingly includes legal violations of its own the agency was hoping to keep hidden. What Bamford had obtained was a DOJ Inspector General's report detailing the CIA and NSA's abuse of electronic surveillance.

The NSA felt it should have been notified and given a chance to redact or withhold the documents. The DOJ, understandably, felt no compunction to share the documents with the subject of its investigation while the investigation was still underway. (This makes it surprising the documents ever made their way into Bamford's hands considering ongoing investigations make for handy FOIA exemptions.)

Despite the documents being made public, the NSA tried to argue they were still classified. And if Bamford was in possession of classified documents -- even ones obtained legally through FOIA requests -- he could be made to face espionage charges.

Due to “the serious consequences” of the FOIA disclosure, the NSA Director asked that the DOJ immediately contact Bamford to retrieve the documents along with all copies and to learn who else had that information. The NSA Director also requested that the DOJ tell Bamford “that his retention or disclosure of such information could result in his prosecution under 18 U.S.C. 793 or 798,” which are better known as the Espionage Act.

The government has never been shy about prosecuting whistleblowers and leakers. But in most cases, the documents at the center of the cases haven't been handed over to journalists as the result of a completely legal process. That the NSA would consider pushing for an espionage prosecution over legally-obtained documents shows how far the Intelligence Community is willing to go to protect its reputation.

Filed Under: doj, espionage act, foia, james bamford, journalism, nsa, transparency

Senator Wyden's 702 Reform Bill Would Limit Backdoor Searches, Permanently Kill 'About' Collection

from the incidental-permadeath dept

As promised, Ron Wyden (along with Rand Paul) has delivered an antidote to the Senate Intelligence Committee's completely terrible Section 702 "reform" bill. That bill, authored by Sen. Burr, would extend the NSA's 702 powers until 2025 while allowing US law enforcement to use collected intelligence for normal law enforcement purposes. It also would have turned the NSA's "about" collection back on, provided no one opposed it with directly-targeted legislation. This program's ability to "inadvertently" sweep up US persons' communications was so concerning the NSA voluntarily shut it off. (It asked to have it turned back on less than two months later, however.)

Charlie Savage of the New York Times has published the latest draft of the Wyden reform bill, titled the USA RIGHTS Act of 2017. (His annotated version of the bill can be found here.) Wyden's bill [PDF] makes several significant changes, including codification of the NSA's voluntary "about" collection shut down.

Beyond preventing the NSA from resuming a collection it has abused since inception, the bill also shortens the extension period to 2021, ensuring the next debate over Section 702 collections isn't put off for nearly a decade. (The Burr bill extended the sunset to 2025. The House Subcommittee's lukewarm reform bill set it at 2023.)

It also would attempt to close the "backdoor search" loophole that allows US government agencies to obtain domestic communications without a warrant. Wyden's bill adds a warrant requirement for these searches -- including those with a national security purpose. This serves two purposes. First, it brings the collection of domestic communications via NSA surveillance back in line with the Fourth Amendment. Additionally, it provides for better accountability by ensuring any database searches leave a paper trail. It also bans the acquisition of content "known to be entirely domestic."

The bill also provides for better notification of prosecutors' use of Section 702-derived evidence. It limits the use of Section 702 surveillance to national security cases, with one exception: direct approval from the Attorney General. The new notification requirements will attempt to circumvent parallel construction by preventing the government from withholding notification if there is any other conceivable way it could have obtained the same evidence (inevitable discovery, normal law enforcement surveillance methods, etc.).

It also adds further reporting requirements, including mandatory production of numbers Wyden has been seeking for years: incidentally-collected US persons' communications. It would also require the FBI to turn over the number of US persons queries it performs using NSA-collected intel.

There are other good aspects to the bill -- stuff normally not discussed during surveillance authority sunsetting. The bill would divest the power currently held by Chief Justice John Roberts. Chief justices have controlled FISA court judge selection for most of the last 30 years, resulting in a long stream of conservative picks, many of them former government prosecutors. This bill would allow all 13 circuits to nominate judges for FISC posts, which should help prevent future FISA judge picks from being so closely aligned with the Chief Justice's views.

Finally, the bill also provides for additional Privacy and Civil Liberties Oversight Board input. The PCLOB is all but dead, but if it's revived, it would have access to Intelligence Community whistleblower complaints.

This is the best reform bill we've seen offered yet. But the clock continues to tick down to 702's renewal. Chances are, Sen. Burr's control of the Senate Intelligence Committee isn't going to do much to ensure this bill moves forward intact, if it moves forward at all. Between Burr and Sen. Feinstein, the oversight committee has been internally limited in terms of actual oversight. Wyden's presence on the committee is the wild card, but entrenched powers continue to limit his effectiveness. Hopefully, some of this bill will replace the worthless, toothless "reforms" proposed by Sen. Burr and continue to nudge the Intelligence Community towards compliance with a number of Constitutional amendments.

Filed Under: about collection, backdoor searches, nsa, rand paul, reform, ron wyden, section 702, surveillance

Senator Burr Pitches 702 'Reform' That Would Give NSA Back Its Most Abused Collection Program

from the word-is-pretty-much-meaningless dept

The Senate Intelligence Committee has released its Section 702 reauthorization bill [PDF]. Rather than fix anything, it makes pretty much everything worse. This is largely due to Sen. Burr's influence, who probably felt he had to bring something to the debate, but couldn't bear to part completely with his "clean, forever reauthorization" dreams.

Senator Burr is somehow claiming this is a "reform" bill. Marcy Wheeler has written an excellent post describing all the ways in which it isn't, especially the tail end of the bill which pretends to limit US law enforcement access to NSA collections.

It does so in Section 5, in what is cynically called “End Use Restriction,” but which is in reality a vast expansion of the uses to which Section 702 data may be used (affirmatively codifying, effectively, a move the IC made in 2015). It permits the use of 702 data in a criminal proceeding for any criminal proceeding that “Affects, involves, or is related to” the national security of the United States (which will include proceedings used to flip informants on top of whatever terrorism, proliferation, or espionage and hacking crimes that would more directly fall under national security) or involves,

Death

Kidnapping

Serious bodily injury

Specified offense against a minor

Incapacitation or destruction of critical infrastructure (critical infrastructure can include even campgrounds!)

Cybersecurity, including violations of CFAA

Transnational crime, including transnational narcotics trafficking

Human trafficking (which, especially dissociated from transnational crime, is often used as a ploy to prosecute prostitution; the government also includes assisting undocumented migration to be human trafficking)

So, just the "serious" crimes. This is how agencies like the FBI are using 702 collections already. All Burr's bill would do is codify the use of foreign-facing national security agency to collect and retain communications related to domestic criminal activity -- some of it potentially rather minor.

Beyond that, the bill looks to give the NSA back its "about" program. This is the program the NSA abandoned after pushback from the FISA court and (perhaps) as a way to dodge uncomfortable questions about the continued collection of domestic communications. This was a voluntary move by the NSA and it was already asking to have its collection back a couple of months later.

Burr's 702 bill would hand the NSA back its program with a 30-day waiting period during which the House or Senate could introduce a bill forbidding the reinstatement of the program. Should no bill be introduced within the notice period, the NSA could pick up where it left off and go back to abusing a collection program it has never not abused since its inception.

It also allows the NSA to make "emergency" claims about its "about" program to bypass legislative attempts to block it. This wouldn't automatically nullify legislative efforts to end the about collection permanently, but it would allow the NSA to continue collecting while the issue is being debated.

So, it's basically what one would expect from one of top hardline supporters of the NSA. Good thing Burr is one of the top men in the "oversight" committee. He's willing to give the NSA what it wants -- along with the stuff it gave up -- and for more years than the House Judiciary Committee's tepid reform option. Burr's bill would push the next renewal fight off until 2025, two years more than the 2023 sunset in the House bill. Fortunately, there may be a third option in play soon. Ron Wyden has announced he's preparing a 702 bill and is pushing the Senate Intelligence Committee to make renewal hearings public.

Filed Under: about collection, fisa, fisa amendments act, mass surveillance, nsa, richard burr, section 702, senate intelligence committee, surveillance

Hackers Grab More NSA Exploits, Possibly With Assistance Of Russian Antivirus Developer

from the three-strikes-program-in-effect dept

Yet another NSA breach is being reported -- this one linked to Russian antivirus developer, Kaspersky Lab. The Wall Street Journal broke the news, detailing the apparent exfiltration of NSA exploits via Kaspersky antivirus software by Russian hackers (likely paywall).

Given the US government's recent decision to ban the use of Kaspersky AV software, one might assume Kaspersky itself acted maliciously. But the details in the story -- along with analysis from other journalists and researchers -- suggests the AV software may have done nothing more than its job.

The hackers appear to have targeted the contractor after identifying the files through the contractor’s use of a popular antivirus software made by Russia-based Kaspersky Lab, these people said.

The theft, which hasn’t been disclosed, is considered by experts to be one of the most significant security breaches in recent years. It offers a rare glimpse into how the intelligence community thinks Russian intelligence exploits a widely available commercial software product to spy on the U.S.

The incident occurred in 2015 but wasn’t discovered until spring of last year, said the people familiar with the matter.

The stolen material included details about how the NSA penetrates foreign computer networks, the computer code it uses for such spying and how it defends networks inside the U.S., these people said.

A few interesting details stand out:

First, the discovery of files via antivirus software was made easier by the way Kaspersky AV operates.

It’s basically the equivalent of digital dumpster diving,” said Blake Darché, a former NSA employee who worked in the agency’s elite hacking group that targets foreign computer systems.

Kaspersky is “aggressive” in its methods of hunting for malware, Mr. Darché said, “in that they will make copies of files on a computer, anything that they think is interesting.” He said the product’s user license agreement, which few customers probably read, allows this.

The combined guesswork of the Wall Street Journal's sources suggest snippets of NSA malware code were discovered on a contractor's personal computer. Kaspersky AV has been banned from use inside the NSA for years, but nothing prevents NSA contractors from installing it on their home computers. In this case, a contractor had files on their personal computer that never should have left the NSA. (Well… at least not in this fashion. Taking sensitive files off grounds can be a criminal offense. Deploying these files to compromise computers and devices around the world, however, is just the daily work of the NSA's Tailored Access Operations.)

The unanswered question appears to be how state-sponsored Russian hackers determined which computer to target. Some suspect Kaspersky employees informed the Russian government of their discovery, but the Journal article offers no clarifying statements.

As Marcy Wheeler points out, the NSA could have made this bad situation worse by "hacking back."

[N]one of the rest of the report explains how Kaspersky could have learned so much about NSA’s tools.

We now may have our answer: initial discovery of NSA tools led to further discovery using its AV tools to do precisely what they’re supposed to. If some NSA contractor delivered all that up to Kaspersky, it would explain the breadth of Kaspersky’s knowledge.

It would also explain why NSA would counter-hack Kaspersky using Duqu 2.0, which led to Kaspersky learning more about NSA’s tools.

The Wall Street Journal says the identity of the contractor whose laptop was compromised is still unknown. Not so fast, says Washington Post's Ellen Nakashima, who's been following these developments for a few years now.

The employee involved was a Vietnamese national who had worked at Tailored Access Operations, the elite hacking division of the NSA that develops tools to penetrate computers overseas to gather foreign intelligence, said the individuals, who spoke on condition of anonymity to discuss an ongoing case. He was removed from the job in 2015, but was not thought to have taken the materials for malicious purposes such as handing them to a foreign spy agency, they said.

One NSA figure who may not survive this third major breech is its boss, Mike Rogers. His head was on the chopping block for breaches under his command back when Obama was still in office. A third major breach of NSA security may be a breach too far.

In a few short years, the NSA has gone from "No Such Agency" to the world's best unofficial source of malware. It's something to keep in mind every time the agency pitches an expansion of surveillance powers. It can't keep an eye on its own backyard because it's too busy staring into everyone else's.

Filed Under: exploits, leaks, malware, nsa, russia
Companies: kaspersky lab

The NSA's 'Time Machines' Make It Incredibly Easy To Violate Section 702 Restrictions

from the collect-all-the-things! dept

Marcy Wheeler has a fascinating post about NSA collection activities under Section 702 and Executive Order 12333. The rules governing the collections allow the NSA to gather communications when a targeted foreigner leaves the country, but are supposed to cease when this target returns to the United States. It's something that's easier said than done, even when the NSA engages in good faith efforts to abide by these restrictions.

As Wheeler points out, the collection efforts don't always comply with these rules, and the way they're constructed allows the NSA to collect communications and other data it shouldn't have access to. First, this is how they're supposed to work:

The short version is that FISA imposes some restrictions on whether you can collect data at rest to obtain data from outside the period of a FISA order. Thus, if you're not supposed to collect on someone when they're in the US (whether that person is a US person or a foreigner), there are classified restrictions about whether you can collect stored data from that period.

None of these rules are (as far as I'm aware) public, but there are rules for all the various laws. In other words, you're not supposed to be able to collect GMail on a foreigner while they're in the US, but you're also not supposed to be able to cheat and just get the same Gmail as soon as they leave the country.

When a US person is targeted, violations are even more likely. Again, the NSA can collect data and communications created when this person is located overseas, but is not supposed to have access to anything created while the person was in the United States. But it doesn't always do this, thanks in part to how it conducts its FISA searches.

This is even more complex for Americans. Domestically, there are two kinds of collection: 1805, which is the collection of data in motion — an old fashioned wiretap, and 1824, which is called a "physical search" order. The government likes to hide the fact that the collection of data at rest is accomplished with an 1824 physical search order, not 1805. So an 1824 order might be used to search a closet, or it might be used to image someone's hard drive. Most often, 1805 and 1824 get combined, but not always (the FISC released a breakdown for these last year).

So, when this target travels overseas, the person data can be collected. While it's restricted to the time period the person is out of the country -- and further restricted by the period covered by the FISA order -- the NSA's collection programs, which include implants on devices, continue to gather data in motion while the collection is supposedly forbidden. This is stored by the NSA, accessible at any time.

Data at rest is an even bigger problem. This often comes from device imaging or exfiltration via hacking. Data at rest can come from any time period, including months or years before the person became an NSA target. This is the end result of the NSA's multiple collection authorities and its harvesting tactics.

Effectively, once someone leaves the country the NSA has access to time machines to collect data from the past, though there are supposed to be limits on doing this.

[...]

[B]ecause of the differing rules on data in motion and data at rest — and because of the truly awesome methods used as soon as someone goes overseas — there are actually a lot of ways that NSA can get around the legal limitations based on space by playing with the limitations on time.

As Wheeler notes, it's a problem for the NSA, even when it engages in good faith collection efforts. Segregation of data is an ongoing issue, one highlighted by its recent abandonment of its "about" email collection. Most of the legal authorities used are seldom discussed because they remain shrouded in official secrecy, so there's no telling how often violations occur. But the NSA's data-harvesting "time machines" clearly violate guidelines and are yet another reason no one should be in a hurry to grant a clean reauthorization of Section 702 at the end of this year.

Filed Under: 702, nsa, section 702, surveillance, time machine

As Expected, EU Court Of Justice To Review If Internet Company's Privacy Practices Are Acceptible

from the here-we-go dept

The European Court of Justice is going to look into the acceptability of US internet company's privacy practices under the so-called "Privacy Shield" framework that was put in place last year. As you may recall, for years, the EU and the US had a "safe harbor" agreement, under which tech companies underwent a fairly silly and almost entirely pointless process (I know, because we did it ourselves...) by which the companies effectively promised to live up to the EU's data protection rules, in order to move data from servers in the EU across the Atlantic to the US. It is important that companies be allowed to do this, because without it, the internet doesn't function all that well. But, because of NSA snooping, it became clear that what companies were promising couldn't match what was actually happening. And thus, the EU Court of Justice tossed out the framework, saying that it violated EU data protection rules.

After a bit of a scramble, the EU and the US came to an agreement on another framework, called the "Privacy Shield" that both argued was acceptable. It required US companies to do better in handling Europeans' data, to make sure EU residents had redress over data protection and included some transparency requirements regarding US government access to the data. However, as we noted at the time, unless the US was drastically changing how the NSA did surveillance, it seemed nearly impossible for the Privacy Shield to be valid under EU law. And, indeed, Max Schrems, the guy whose lawsuit brought down the original "safe harbor" quickly challenged the Privacy Shield in an Irish court. Over the past few months, we've pointed out that some of Trump's statements on surveillance made it clear that the Privacy Shield was not likely to survive.

Earlier this week, the Irish court asked the European Court of Justice to review. The ruling is long (over 150 pages) and pretty detailed. The court clearly recognizes how important this issue is:

The case raises issues of very major, indeed fundamental, concern to millions of people within the European Union and beyond. Firstly, it is relevant to the data protection rights of millions of residents of the European Union. Secondly, it has implications for billions of euros worth of trade between the EU and the US and, potentially, the EU and other non-EU countries. It also has potentially extremely significant implications for the safety and security of residents within the European Union. There is considerable interest in the outcome of these proceedings by any parties having a very real interest in the issues at stake.

The court hasn't yet officially asked the CJEU to weigh in, but rather has said that it will -- but first it wants the parties involved in the case to more or less argue about what exactly should be the questions submitted to the CJEU.

Most of the ruling itself is basically around whether or not there's anything to discuss here at all. Facebook -- the service whose privacy practices are at issue in this particular case -- tried to argue that because surveillance issues are "national security" and there's a carve out for national security, there's no issue with the Privacy Shield But the court doesn't buy that. First, it says that the issue under scrutiny is about the relationship between the EU and its member states (and how the data protection rules work) rather than a question about "national security" in the US. Similarly, it points to the original Schrems ruling that got the old safe harbor tossed out and notes that no one had a problem with saying the law applied in that case:

The submission is inconsistent with the ruling of the High Court in Schrems v. The Data Protection Commissioner [2014] 3 I.R. 75 and the CJEU in Schrems where the court proceeded on the basis that it had jurisdiction to rule on the reference. If Facebook’s submission in this case is correct, it did not have jurisdiction so to proceed. Eight Member States, the European Parliament, the European Commission and the European Data Protection Supervisor intervened in those proceedings. If Facebook’s point was well made, it is remarkable that none of these participants raised this fundamental matter of jurisdiction.

So, there's still time before the CJEU will sort this out, but we stand by our initial statement. Unless the US changes its NSA surveillance practices, it's difficult to see how the Privacy Shield comes to an end any different than the old privacy safe harbors. If the US doesn't want to have the Privacy Shield rejected again, it might want to start by reforming surveillance -- and it can do that right away in refusing to renew Section 702 of the FISA Amendments Act without significant reform and modifications.

Filed Under: cjeu, data protection, max schrems, nsa, privacy shield, surveillance
Companies: facebook